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REMARKS 



Applicant has carefully reviewed the application in light of the Office Action dated 
January 24, 2002. At the time of the Office Action, Claims 9-13, 22-24, and 26 were pending 
in the application. 

Section 112 Rejections 

Claim 26 stands rejected under 35 U.S.C. § 112, 2nd paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which Applicant 
regards as the invention. Applicant has amended Claim 26 to correct antecedent basis. 
Applicant respectfully submits that the scope of protection of Claim 26 has not been 
narrowed. Applicant further submits that no new matter is added by this amendment and 
requests withdrawal of this rejection. 

Section 103 Rejections 

Claims 9-13, 22-24, and 26 were rejected under 35 U.S.C. § 103, as being 
unpatentable over U.S. Patent No. 5,008,814 issued to Mathur ("Mathur") in view of U.S. 
Patent No. 6,338,149 issued to Ciccone, Jr., et al. ("Ciccone"). Applicant respectfully 
traverses this rejection, and the assertations and determinations therein. 

"In determining the differences between the prior art and the claims, the question 
under 35 U.S.C. 103 is not whether the differences themselves would have been obvious, but 
whether the claimed invention as a whole would have been obvious." MPEP § 2141.02. A 
prima facie case of obviousness requires that each and every claim limitation be taught or 
suggested in the references and there be a suggestion or motivation to modify the reference. 
See MPEP § 2143. The Examiner suggests that Mathur "includes the steps of downloading, 
installing, determining (verifying operating correctly) and restoring the first version." Office 
Action, p. 2-3. In contrast, Claim 9 recites, in part, "automatically installing a downloaded 
update to generate a second version of the program" and "automatically determining whether 
the second version of the program is operating correctly" (emphasis added). Mathur does not 
teach or suggest at least these elements of Claim 9. Instead, Mathur teaches "how a trial use 
of a new system software is initiated. The trial use is initiated when the operator issues a 
'cutover' command to a master task." Mathur, c. 12, 11. 9-12 (emphasis added). Mathur 
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further teaches "an update process whereby a system software in a plurality of target nodes is 
designated as a preferred operative version of a node. The update process is initiated by an 
operator command..." Mathur, c. 12, 11. 62-66 (emphasis added); see, e.g., Mathur, 
Appendix A: 

SL_OPER_CUTOVER_QUERY: 
/* When the user requests a memory card query, th. . . 
/* message type is either one of these. The later. . . 
/* done during a cutover request from the user. 

(emphasis added). 

Ciccone also does not teach or suggest at least these elements of Claim 9. Instead, 
Ciccone teaches "a user 58, administrator 50, or help desk person 54 employ the program 
sppcheck 40 to identify deviations from the expected product states." Ciccone, c. 7, 11. 14-17 
(emphasis added); see also id., FIGURE 2. Ciccone further teaches that "the administrator 
50 executes the installation instructions 74 for the product on the desired node 76." Ciccone, 
c. 8, 11. 49-51 (emphasis added); see also id., FIGURE 3. In addition, while Ciccone teaches 
fourteen specific tasks that are automatically performed, Ciccone does not teach or suggest 
"automatically installing a downloaded update to generate a second version of the program" 
or "automatically determining whether the second version of the program is operating 
correctly." See Ciccone, c. 20, 1. 57 - c. 21, 1. 10. Therefore, neither Mathur nor Ciccone, 
either alone or in combination, teach or suggest every element of Claim 9. Applicant 
respectfully requests the Examiner to reconsider and withdraw the rejection for Claim 9. 

Amended Claim 10 recites "automatically distributing the downloaded update to a 
disparate network site operating the first version of the program." Applicant respectfully 
traverses the Examiner's rejection of Claim 10. There is no suggestion or motivation to 
modify Mathur with "an automatically distributing step without a means for controlling the 
operator node N n " as the Examiner claims. Office Action, p. 4. Instead, Mathur teaches 
away from this because Mathur teaches that "[w]hen the operator node N 0 receives a 
distribution command, it relays appropriate messages to both the source node N s and the 
destination node Na." Mathur, c. 5, 11. 27-30 (emphasis added). The Examiner admits that the 
"so called c operator node No'" is, by definition, the node "at which the distribution command 
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is entered." Office Action, p. 4. Consequently, Mathur teaches away from the "automatically 
distributing" limitation, as Mathur teaches the "means for controlling the operator node" is 
manual. In addition, "[a] prior art reference must be considered in its entirety, i.e., as a 
whole , including portions that would lead away from the claimed invention." MPEP § 
2141.02 (emphasis added). Consequently, Applicant respectfully submits that Mathur does 
not disclose, teach, or suggest at least "automatically distributing." 

Amended Claim 10 further recites "automatically operating the second version of the 
program in place of the first version at the disparate network site." Mathur teaches away 
from this as it discloses "an update process whereby a system software in a plurality of target 
nodes is designated as a preferred operative version of a node. The update process is initiated 
by an operator command.. " Mathur, c. 12, 11. 62-66 (emphasis added). This process is 
detailed in Appendix A where the operator must run the SLOPERUPDATEREQ method 
before the SLM_UpdateHandler function, the algorithm for updating the preferred operative 
version, may run. See Mathur, Appendix A, cc. 31-34. 

Ciccone also teaches away from these elements. For example, Ciccone teaches "a 
user 58, administrator 50, or help desk person 54 employ the program sppcheck 40 to 
identify deviations from the expected product states." Ciccone, c. 7, 11. 14-17 (emphasis 
added); see also Ciccone, FIGURE 2. In addition, while Ciccone teaches fourteen specific 
tasks that are automatically performed, Ciccone does not teach or suggest "automatically 
installing a downloaded update to generate a second version of the program" or 
"automatically determining whether the second version of the program is operating 
correctly." See Ciccone, c. 20, 1. 57 - c. 21, 1. 10. Therefore, neither Mathur nor Ciccone, 
either alone or in combination, teach or suggest every element of amended Claim 10. 

Further, the Examiner notes that "it would also have been obvious to one skilled in the 
pertinent art at the time of invention was made to implement such an automatic step into the 
Mathur system." Office Action, p. 4. Applicant respectfully submits that the Examiner has 
not met the prima facie case for obviousness. "Although a prior art device may be capable 
of being modified to run the way the apparatus is claimed, there must be some suggestion or 
motivation in the reference to do so." MPEP § 2143.01 (citation omitted). As the Examiner 
noted, Mathur "advantageously provides the operator a means for controlling the so called 
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'operator node N 0 ."' Office Action, p. 4 (emphasis added). The "advantageous" means of 
Mathur is a manual distribution command. Thus, Mathur indicates that the manual 
distribution command is better than "such an automatic step." Office Action, p. 4. 
Therefore, not only is there no suggestion or motivation to modify Mathur, but Mathur 
teaches away from such a modification. Therefore, Applicant respectfully requests 
withdrawal of this rejection. 

Applicant respectfully denies mischaracterizing the "Mathur manual command 
teachings," Office Action, p. 4, as alleged by the Examiner. The Examiner seems to focus on 
the argument that "operator node N 0 " may or may not be N s . But Applicant did not argue at 
what node the operator enters the command. Instead, Applicant cited various portions of the 
language used by Mathur that explicitly teach the element of an operator entering a 
distribution command at any node. Applicant quoted Mathur in so far as "[a]dvantageously, 
the distribution is initiated by a 'distribution command' which is entered by an operator at an 
input/output device in one of the nodes" The only mention of node N s in Applicant's 
arguments was a quote of Mathur 's teaching "the communication of a new system software 
version from a source node N s to a destination node Na." Further, N s is merely "[t]he node 
where the new version of system software is installed." Mathur, c. 4, 11. 54-56. Mathur 
teaches that installation is not performed at N s until it receives a distribution message from 
N G . See generally, Mathur, c. 5, 11. 28-47. Thus, Applicant did not argue, nor is it relevant, at 
which node the operator entered the manual distribution command. 

Therefore, Applicant respectfully requests the Examiner to reconsider and withdraw 
the rejection for amended Claim 10. Independent Claims 1 1 and 12 are patentable for at least 
the reasons discussed above in association with Claims 9 and 10. 

Further, Applicant respectfully traverses the Examiner's Official Notice in regards to 
Claim 12. Applicant respectfully requests the Examiner to come forward with evidence that 
supports the Official Notice. See MPEP § 2144.03. Specifically, the Examiner should 
provide a reference or affidavit supporting such Official Notice. Applicant respectfully 
submits that the combination of Mathur and Ciccone with Official Notice fails to disclose or 
suggest Applicant' s invention. Thus, Applicant respectfully requests allowance of 
independent Claims 11 and 12. 
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Applicant respectfully traverses the Examiner's rejections of Claim 22. The 
Examiner submits that "it would become apparent to one skilled in the pertinent art at the 
time of the invention was made to implement and/or applying Mathur and Ciccone teaching 
for such a typical intrusion detection system." Office Action, p. 5. There is no teaching, 
suggestion, or motivation in either Mathur or Ciccone for such a modification because neither 
reference mentions an intrusion detection system. 

Also, Claim 22 recites, in part, "each of the intrusion detection sensors operable ... to 
automatically install a downloaded update to generate a second set of intrusion detection 
signatures ... and to automatically distribute the downloaded update to the remaining 
intrusion detection sensors for installation." There is no suggestion or motivation to modify 
Mathur with "an automatically distributing step without a means for controlling the operator 
node N n" as suggested by the Examiner. Office Action, p. 4. Instead, Mathur teaches away 
from this element because Mathur teaches that "[w]hen the operator node N c receives a 
distribution command, it relays appropriate messages to both the source node N s and the 
destination node Nd." Mathur ^ c. 5, 11. 27-30 (emphasis added). The Examiner admits that the 
"so called 'operator node N 0 '" is, by definition, the node "at which the distribution command 
is entered." Office Action, p. 4. Consequently, Mathur teaches away from the "automatically 
distributing" limitation, as Mathur teaches the "means for controlling the operator node" is 
manual. 

Consequently, Applicant submits that Mathur does not disclose, teach, or suggest 
every element of Claim 22. Therefore, Applicant respectfully requests the Examiner to 
reconsider and withdraw the rejection for amended Claim 22. 

Dependent Claim 26 depends from dependent Claim 13, which depends from 
independent Claim 12. Also, dependent Claims 23 and 24 depend from independent Claim 
22. Claims 10, Claims 11, 12, and 22 are shown above to be allowable over the cited 
references. Thus, dependent Claims 13, 23, 24, and 26 are allowable over the cited 
references as depending from an allowable base claim and including further distinctions over 
the cited references. For at least these reasons, Applicant respectfully requests allowance of 
dependent Claims 13, 23, 24, and 26. 
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CONCLUSION 



Applicant has made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other reasons clearly apparent, Applicant respectfully 
requests full allowance of Claims 9-13, 22-24, and 26. 

Although no fees are believed due, the Commissioner is hereby authorized to charge 
any fees or credit any overpayments to Deposit Account No. 02-0384 of Baker Botts llp. 

If there are matters that can be discussed by telephone to further the prosecution of 
this application, Applicant respectfully requests that the Examiner call their attorney at the 
number listed below. 



Date: April 13 ,2002 

Please Send Correspondence to : 

Matthew B. Talpis, Esq. 

Baker Botts L.L.P. 

2001 Ross Avenue, Suite 600 

Dallas, Texas 75201-2980 

Tel: (214)953-6984 

Fax: (214)661-4984 

matt.talpis@bakerbotts.com 



Respectfully submitted, 



BAKER BOTTS L.L.P. 



Attorneys for Applicant 




Matthew B. Talpis 
Reg. No. 45,152 



DAL01:657049.1 



ATTORNEY'S DOCI^: £ PATENT 

* 062891.0240 09/241,823 

13 

Attachment A - Marked-Up Claims 

A marked-up version of the amended claims appears below. For the convenience of 
the Examiner, all of the pending claims have been reproduced regardless of whether amended 
or not. Kindly amend the claims as follows: 

1. (Previously cancelled without prejudice or disclaimer) 

2. (Previously cancelled without prejudice or disclaimer) 

3. (Previously cancelled without prejudice or disclaimer) 

4. (Previously cancelled without prejudice or disclaimer) 

5. (Previously cancelled without prejudice or disclaimer) 

6. (Previously cancelled without prejudice or disclaimer) 

7. (Previously cancelled without prejudice or disclaimer) 

8. (Previously cancelled without prejudice or disclaimer) 
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9. 



A method for updating a first version of a program operating at a network site, 



composing: 



in response to an automated event, automatically downloading from a remote site any 
update for the program; 

automatically installing a downloaded update to generate a second version of the 
program; 

after installation of the downloaded update, automatically determining whether the 
second version of the program is operating correctly; 

in response to correct operation of the second version, operating the second version of 
the program in place of the first version at the network site; and 

in response to incorrect operation of the second version, automatically restoring the 
first version of the program for operation at the network site. 
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10. (Amended) A method for updating a first version of a program operating at 
a network site, comprising: 

in response to an automated event, automatically downloading from a remote site any 
update for the program; 

installing a downloaded update to generate a second version of the program; and 

operating the second version of the program in place of the first version at the 
network site; 

automatically distributing the downloaded update to a disparate network site operating 
the first version of the program; 

automatically installing the downloaded update to generate the second version of the 
program at the disparate network site; and 

automatically operating the second version of the program in place of the first 
version at the disparate network site. 
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1 1 . (Amended) A method for updating a first version of a program operating at 
a network site, comprising: 

in response to an automated event, automatically downloading from a remote site any 
update for the program; 

installing a downloaded update to generate a second version of the program; 

after installation of the downloaded update, automatically determining whether the 
second version of the program is operating correctly at the network site; 

in response to incorrect operation of the second version, automatically restoring the 
first version of the program for operation at the network site; and 

in response to correct operation of the second version at the network site: 



automatically distributing the downloaded update to a disparate network site 
operating the first version of the program; 

automatically installing the downloaded update to generate the second version 
of the program at the disparate network site; and 

automatically operating the second version of the program in place of the first 
version at the disparate network site. 
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12. (Amended) A method for updating a first version of a program operating at 
a network site, comprising: 

in response to an automated event, automatically downloading from a remote site any 
update for the program; 

automatically installing a downloaded update to generate a second version of the 
program; and 

operating the second version of the program in place of the first version at the 
network site; 

broadcasting over a network an update message; 

receiving in response to the update message a request for the downloaded update from 
each of a plurality of disparate network sites operating the first version of the program; 

automatically distributing the downloaded update to the disparate network sites 
requesting the downloaded update; 

automatically installing the downloaded update to generate the second version of the 
program at each of the disparate network sites; and 

automatically operating the second version of the program in place of the first 
version at each of the disparate network sites. 

13. The method of Claim 12, further comprising: 
receiving a recovery event at one of the network sites; 

automatically restoring the first version of the program at the network site at which 

the recovery event was received; 

broadcasting a recovery message from the network site over the network; and 
automatically restoring the first version of the program at each of the remaining 

network sites operating the second version of the program. 

14. (Previously cancelled without prejudice or disclaimer) 

15. (Previously cancelled without prejudice or disclaimer) 

16. (Previously cancelled without prejudice or disclaimer) 



17. (Previously cancelled without prejudice or disclaimer) 
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18. (Previously cancelled without prejudice or disclaimer) 

19. (Previously cancelled without prejudice or disclaimer) 

20. (Previously cancelled without prejudice or disclaimer) 

21 . (Previously cancelled without prejudice or disclaimer) 
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22. An intrusion detection system, comprising: 

a private network including a plurality of sites connected to a public network, each 
site including an intrusion detection sensor operating with a first set of intrusion detection 
signatures; and 

each of the intrusion detection sensors operable to automatically download from a 
remote site any update for the intrusion detection signatures in response to a specified event, 
to automatically install a downloaded update to generate a second set of intrusion detection 
signatures, to operate with the second set of intrusion detection signatures, and to 
automatically distribute the downloaded update to the remaining intrusion detection sensors 
for installation. 

23. The system of Claim 22, wherein the specified event is an automated event. 

24. The system of Claim 23, wherein the automated event is a timed event. 

25. (Previously cancelled without prejudice or disclaimer) 

26. (Amended) The method of Claim 13 wherein the recovery event occurs in 
response to incorrect operation of the [intrusion detection] second version of the p rogram. 
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